in

Welcome!

Who I am

I am a CISSP-certified security consultant looking to help you secure your product. In addition to 15+ years' worth of work and training across security domains, I have extensive experience in application development. A professional, I can work independently or as part of a team.

Here to keep you successful

I have worked on projects of many scales and scopes, from securing a single product to building an entire security program. I can help you solve many problems, whether you need penetration testing done, a threat model performed, or a disaster recovery plan drafted. I can be there for the entire process from planning through implementation, or for only as much of it as you need. Think of me as a Renaissance Lego brick.

Although I am based in the Twin Cities, Minnesota (USA) area, I am interested in projects with clients anywhere in the world. Part of the beauty of consulting is the inherent ability to telecommute and travel. So even if you're not in Minnesota — or even the US — we can still do business.

Please contact me with any questions.

Nate Larson

What I do

Threat Modeling / Risk Assessment STRIDE-based threat models for your device architecture: firmware, mobile apps, cloud backend, and everything connecting them. You get a prioritized risk register your engineers can actually act on, not a 40-page report that sits in a drawer.

FDA Cybersecurity Readiness Section 524B, Secure Product Development Framework (SPDF) documentation, and SBOM generation mapped directly to your 510(k)/eSTAR submission requirements. Ready to review and submit.

Software, Firmware, and Hardware Security Testing SAST, SCA, and manual review of your codebase and firmware, as well as DAST/pen-testing, with findings triaged by actual exploitability and clinical risk -- not just CVSS scores that don't reflect the real attack surface.

Architecture and Design Review Bring me in during R&D, before your architecture is locked. Catching a design flaw at the whiteboard stage costs you an afternoon. Catching it after tooling is built costs you a redesign.

Security Program Build-Out For teams ready to hire their first security function: I'll help you define the role, stand up the initial program, and train your engineers -- so your eventual hire inherits a strong foundation, not a blank page.

The problem

You're building a connected medical device. The engineers are heads-down on the product. Your FDA submission timeline is tight. Somewhere in the back of your mind is a question nobody on your team has time to fully answer:

"Is this thing actually secure -- and can we prove it to the FDA?"

Section 524B isn't optional anymore. A weak SBOM, a missing threat model, or a penetration test finding discovered late can delay your 510(k) submission by months -- and at any medical device company, months are runway you don't have.

You don't need a Director of Security. You need someone who's done this, who can walk in, assess the real risk, and hand your team a clear path to submission-ready -- and even help get it done.

Measuring software maturity using the OWASP SAMM

Contact me for expert help with a maturity assessment, or learning how to do them yourself. Download the PGP public key to email privately.

What is OWASP?

A quick intro: OWASP (the Open Worldwide Application Security Program) is an open-source, open community of security practitioners (and anyone interested in securing all the things, really), with lots of projects ranging from application security training and cheat sheets to risk management, and everything between. (If it has to do with AppSec, there's probably an OWASP project for it. Seriously, search the web for "OWASP" and anything AppSec related, and you'll find an OWASP page for it.)

OWASP is far more than the Top 10. There are even more lists than the original Top 10 (but that's for another page).

What is the OWASP SAMM?

The Software Assurance Maturity Model provides a clearly measurable way for organizations to analyze and improve their software security posture. It contains 90 questions covering the following domains across the secure SDLC:

  • Governance
    • Strategy and Metrics
    • Policy and Compliance
    • Education and Guidance
  • Design
    • Threat Assessment
    • Security Requirements
    • Security Architecture
  • Implementation
    • Secure Build
    • Secure Deployment
    • Defect Management
  • Verification
    • Architecture Assessment
    • Requirements-driven Testing
    • Security Testing
  • Operations
    • Incident Management
    • Environment Management
    • Operational Management

The model can focus on an individual software or infrastructure project or be applied to the entire organization (relating to secure software). The SAMM team is even working on community-sourced data for a benchmark, so orgs can compare their maturity to others (anonymously of course -- as security practitioners, we are concerned with privacy, naturally).

The model is available in many formats:

  • Spreadsheet
  • PDF
  • On-line surveys (created by various companies)

Why contract a maturity consultant?

Most maturity consulting is executed by a team of underexperienced people who are unable to thoroughly explain the topics and what the questions are asking (performing maturity assessments is not usually why people get into security), nearly guaranteeing an inconsistent view of the enterprise.

I interview the teams and stakeholders involved in the craft and delivery of software directly, and combine their answers in a concise, cohesive view of your organization's security maturity. I provide consistency, expertise, and guidance on next steps. Further, I can train your personnel to perform the interviews or answer the questions and deliver the reports and metrics themselves, and help them understand the issues the SAMM brings up.

OWASP SAMM official resources

Companies I've helped succeed

  • Med-tech
    • Boston Scientific
    • Cardiac Science
    • Guidant
    • Insulet
    • Patterson
    • Starkey Labs
  • Finance
    • PNC Bank
    • Selective Insurance
    • Wells Fargo
  • Industrial
    • Boeing
    • Comtrol
    • Honeywell
    • Transnet Rating Systems

Who I am not

Some other namesakes around the internet who you might be looking for instead: